Confidential direct communications: a quantum approach using continuous variables 
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We consider the problem of privacy in direct communications, showing how quantum mechanics 
can be useful to guarantee a certain level of confidentiality. In particular, we review a continuous 
variable approach recently proposed by us [S. Pirandola et al., Europhys. Lett. 84, 20013 (2008)]. 
Here, we analyze the degree of privacy of this technique against a broader class of attacks, which 
includes non-Gaussian eavesdropping. 
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I. INTRODUCTION 



Quantum mechanics provides a nice solution to an old 
cryptographic problem, i.e., the key distribution prob- 
lem Going further, we consider whether or not quan- 
tum mechanics could profitably be exploited even for di- 
rect confidential communication, without resorting to the 
use of pre-distributed private keys. Since many quantum 
communication protocols like quantum key distribution 
(QKD) [l| and quantum teleportation have been ex- 
tended to continuous variable systems [1, 0|, i-e., quan- 
tum systems associated to infinite-dimensional Hilbert 
spaces [f|, we find it rather natural to address the prob- 
lem of direct communication in this framework. Here, an 
important role has been played by the bosonic modes of 
the radiation field, and Gaussian states. In particular, 
coherent states of the radiation have become the most 
appealing choice for implementing many quantum infor- 
mation tasks. Along this line, we have shown Q how 
a sender (Alice) can exploit coherent states of a bosonic 
mode in order to send confidential messages to a receiver 
(Bob), with an acceptable degree of privacy. This is the 
first proof-of-principle of a (quasi) confidential quantum 
direct communication (QDC) in the framework of con- 
tinuous variable systems. In particular, this QDC can be 
implemented in an easy way, since it exploits the same 
"quantum hardware" of the standard continuous variable 
QKD, even if this is done via a completely different logic 
of classical operations and communications 0] • The price 
one pays in order to have a simple technique of QDC is 
that a notion of "degree of privacy" must replace the one 
of unconditional security (used in QKD). This means that 
we allow a potential eavesdropper (Eve) to access a lim- 
ited fraction of the information, even if this fraction can 
be evaluated in advance and also made very small. 

The ideal situation for a QDC occurs when Alice and 
Bob are connected by a noiseless channel, so that the 
unique noise they have to correct is due to the continuous 
structure of quantum phase-space @. However, in gen- 
eral, this is not the case and the honest users must ran- 
domly switch instances of direct communication with in- 



stances of statistical checks on the quantum channel. As 
soon as they detect the presence of a non-tolerable noise, 
they promptly stop the communication. The maximum 
noise that can be tolerated is connected to the maximum 
amount of information that they are willing to give up to 
an eavesdropper. In other words, a good QDC protocol 
should enable Alice and Bob to communicate the entire 
message when the noise is suitably low, while losing a 
small amount of information when it is not. According 
to Ref. , the maximum information that Eve can steal 
can be made small at will, but at the expenses of the ef- 
ficiency of the protocol, corresponding to the ratio of the 
number of communicated bits to the number of quantum 
systems used. An alternative approach consists in the 
use of classical error correcting codes, which makes Eve's 
perturbation more evident to Alice and Bob's statistical 
checks. This approach enables the honest users to re- 
duce the number of stolen bits while keeping fixed the 
efficiency of the protocol. This improvement is proven 
assuming the model of eavesdropping is also taken fixed, 
i.e., Eve is restricted to a Gaussian attack given by a 
universal Gaussian doner. 

In the present paper we thoroughly review the re- 
sults of Ref. [f|, giving a more detailed description of 
the various protocols for QDC, together with the basic 
ideas which are behind them. Furthermore, we provide a 
deeper analysis of the possible eavesdropping strategies. 
In particular, we consider new kinds of attacks which are 
non-Gaussian and consist in the intermittent use of Gaus- 
sian doners. These intermittent attacks are proven to be 
more powerful in the eavesdropping of QDC when it is 
aided by classical error correction. As a result, the im- 
provement given by the classical codes is no longer clear if 
Eve is also allowed to optimize her strategy. Despite this 
open problem, the new concepts and the basic schemes 
for QDC have still great potentialities to be explored. 

The paper is organized as follows. In Sec. [H] we review 
the basic protocol for QDC together with its Gaussian 
eavesdropping. In the following Sec. IIII1 we review QDC 
with repetition codes. Its security analysis is performed 
in Sec. IIII Cl for Gaussian eavesdropping, and Sec. IIIIDl 
for a non-Gaussian generalization. Finally, after the con- 



2 



elusions of Sec. IIV1 we have added a discussion on possi- 
ble variants for QDC in Appendix IVI1 



II. BASIC PROTOCOL FOR QUANTUM 
DIRECT COMMUNICATION 



A. Continuous variables of a bosonic mode 

Let us consider a bosonic mode with Hubert space Ti. 
and ladder operators a, a' satisfying [a, a'] = 1. Equiva- 
lently, this system can be described by a pair of quadra- 
ture operators 



is a complex Gaussian function with mean a and variance 
V. As a consequence, the measurement of the arbitrary 
quadrature x provides outcomes x which are distributed 
according to the real Gaussian 
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where A = 1/2 for homodyne detection, while A = 1 for 
heterodyne detection. 



B. Phase-space lattice encoding 
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satisfying the dimensionless canonical commutation rela- 
tion (CCR) [q,p] = i. From the previous CCR we see 
that an arbitrary state of the system p must fulfill the 
uncertainty principle 



V{q)V(p) > 1/4 



(2) 



where V(x) := Tv(px 2 ) — [Tr(px)] 2 denotes the variance 
of an arbitrary quadrature x — q or p. In particular, an 
arbitrary coherent state \a) saturates Eq. © symmet- 
rically i.e., V(q) — V(p) :— A = 1/2, where the value 
1/2 quantifies the so-called quantum shot-noise. This is 
the fundamental noise that affects the disjoint measure- 
ments of the quadratures q and p of a coherent state (via 
homodyne detection Q). Such a noise is instead doubled 
to A = 1 when the two quadratures are measured jointly 
(via heterodyne detection 0]). 

According to the Wigner representation, an arbitrary 
density operator p is equivalent to a characteristic func- 
tion x(A) := Tr[pD(X)], where D(X) := exp(Aat - A*a) 
is the displacement operator. Equivalently, p can be de- 
scribed by a Wigner function, which is a quasi-probability 
distribution defined by the Fourier transform 



W(a) :-- 



d 2 X 



exp (X*a— Xa*) x(A) . 



(3) 



In Eq. ([3]), the Cartesian decomposition of the complex 
variable a = (q + ip)/\^2 provides the real eigenvalues q 
and p of the quadrature operators of Eq. (fTJ). Such vari- 
ables span the phase-space K, — {q,p} of the system and, 
therefore, represent its fundamental continuous variables. 
For a coherent state \a), the Wigner function takes the 
form 



where 



W\a)(a) = C/i/2 (a - a) 



1 I \a-a\ 
5v(a-a) :=^exp — 



(4) 



(5) 



Let us discretize the phase-space K, by introducing a 
square lattice whose unit cell has size equal to 2f2 (see 
Fig. [1]). An arbitrary cell can be addressed by a pair 
of integer indices (u, u') and its center specified by the 
coordinates 



q u = 2Qu , p u t — 2Qu' , 
or, equivalently, by the complex amplitude 

q u + ip U ' 



V2 



(7) 
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FIG. 1: Square lattice of step size 2H in the phase-space. The 
center of each cell is specified by an amplitude a. uu i, where 
(u,u') is a pair of integers representing the address of the 
cell. Each address (u,u) is associated with a pair of bits 
(U, U') given by the parities of it and u' (see the binary digits 
at the figure's border). The picture also shows the masking 
procedure which adds a mask olm to the amplitude a uu i in 
order to create a continuous and Gaussian signal a. 

Thanks to the introduction of this discrete structure, 
two bits of information may be simply encoded in quan- 
tum phase-space. In fact, an arbitrary cell of address 
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(u, u') can be associated with a pair of bits (U, U'), rep- 
resenting the parities of the indices u and v! . In this ap- 
proach, Alice encodes two classical bits (U, U') by choos- 
ing a cell whose address (it, u') is randomly selected ac- 
cording to the relations 

u = 2m + U , v! = 2m! + U' , (9) 

where m and ml are random integers (lo| . Then, she con- 
siders the complex amplitude aw pointing at the center 
of that cell and prepares a corresponding coherent state 
\a uu '}. Such a state is finally sent to Bob, who performs a 
heterodyne detection in order to estimate the amplitude 
a uu > and therefore the encoded information (U,U'). It is 
clear that, even in the presence of a noiseless communi- 
cation channel, Bob's decoding cannot be noiseless since 
the Gaussian shape of the coherent state spreads over the 
whole of phase space. Such a spread inevitably leads to 
an intrinsic error in the decoding process which occurs 
when the coherent state is projected by the measurement 
to wrong peripheral cells. 
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FIG. 2: Intrinsic error probability e(Q) in the decoding of 
Alice's bit U from the g-quadrature of the coherent state. 

Let us evaluate the probability e of an intrinsic error 
when Bob decodes Alice's bit U from the position quadra- 
ture q (the argument may be repeated for the other 
quadrature). Since Bob performs a heterodyne detec- 
tion on the coherent state, the measured value q will be 
distributed around q u according to a Gaussian distribu- 
tion with noise- variance equal to A = 1, i.e., G\(q — q u ). 
Suppose, for simplicity, that U = is encoded in q u = 0. 
According to Fig. [5] an error occurs whenever the mea- 
sured value q falls in one of the crossed cells, i.e., having 
odd index u = ±1,±3, ... (which would lead to the in- 
correct reconstruction of U = 1 by Bob). Hence, the 
probability of an intrinsic error (per quadrature) is equal 
to 

e(fi)=2^ / dqGAq) ■ (10) 



Now, if we fix a tolerable value for the intrinsic error 
probability, we find the corresponding size Q to be used 
for the lattice. In particular, tolerating e — 1% implies 
adopting £1 ~ 2.57. On the one hand, the use of a low 
value for e enables the honest users to approach noise- free 
communication. On the other hand, a large value for 
makes the protocol particularly fragile to eavesdropping. 
In fact, Eve can optimize her attack on the structure of 
the lattice, e.g., by using a non-universal doner which 
is optimized on the centers of the cells. More simply, 
Eve can detect the state, reconstruct its cell, and resend 
another state which is centered in that cell. By resorting 
to this intercept-center-resend strategy, Eve is able to 
remove the noise most of the time for a sufficiently large 
£1. Luckily, we are able to preclude such strategies by 
resorting to the classical procedure shown in the next 
section. 



C. Masking the message and testing the channel 

In order to hide the lattice from Eve, Alice can simply 
add a mask to her message. After the computation of the 
message amplitude a uu i, Alice classically adds a mask 
amplitude cum, in such a way that the total amplitude 
a := ajvr + ot U u' is randomly distributed according to a 
complex Gaussian Qv{oi) with large variance V ^S> H, (see 
Fig. [T|). Operationally, the whole encoding procedure 
goes as follows: 

(1) Lattice Encoding. Alice encodes the message bits 

(U, U') into a message amplitude a uu >. 

(2) Masking. Alice picks a signal amplitude a from a 

wide Gaussian distribution and computes the mask 
glm = ct — ct uu r connecting signal and message. 

(3) Quantum Preparation. Alice prepares a signal 

coherent state \a) to be sent to Bob. 

Having prepared the triplet: a uu i (message), cxm (mask) 
and | a) (signal state), Alice can now perform her quan- 
tum and classical communications (see Fig. [3]). First, 
Alice sends the signal state \a) to Bob, who heterod yne s 
it with outcome f) ~ a. Then, after Bob's detection [111 ] . 
Alice classically publicizes the mask «m- After these two 
steps, Bob gets the pair {(3,01m) from his detection and 
Alice's classical communication. Then, Bob is able to un- 
mask the signal by computing {3 — olm — ct — olm = aw 
and, therefore, estimates the message bits (U, U') via lat- 
tice decoding. 

Clearly, the same decoding steps can be followed by 
Eve too. However, the key point is that Eve must choose 
the probing interaction before knowing the value of the 
mask. Since the signal a is continuous (Gaussian) and 
highly modulated, Eve is prevented from using any kind 
of interaction which privileges a particular portion of 
the phase space. The most natural choice is therefore 
a universal Gaussian interaction. A possible model is 
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given by the universal Gaussian quantum cloning ma- 
chine (UGQCM) [12J. Such a machine maps the signal 
state | a) into a pair of output clones pb (sent to Bob) 
and pe (taken by Eve), each one equal to a Gaussian 
modulation of \a) (a\, i.e., 

Pk = J d 2 » g^ipi) D(ji)\a){a\D^) , (K = B,E) , 

(11) 

where the cloning-noise variances a B and a E symmet- 
rically affect the quadratures and satisfy the optimality 
condition 

a%a% = 1/4 , (12) 

directly imposed by Eq. flSJ) As a consequence of 

Eq. (|lip . the arbitrary quadrature x of the clone K — 
B, E has a marginal distribution equal to G& +cr 2 (x — x). 
The performance of the resulting attack will be explicitly 
studied in the next Section Hi Dl 
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FIG. 4: Control mode (CM). Alice picks up a Gaussian 
amplitude a and prepares a coherent state \a). Such a state 
is sent to Bob and heterodyned with outcome f3 (step 1 in 
the picture). Then, Bob classically informs Alice (step 2) and 
Alice communicates the value of the signal a (step 3). Finally, 
Bob computes the test variable r := /3— a to infer the amount 
of noise a 2 in the channel. 
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FIG. 3: Message mode (MM). From the message bits 
(U,U'), Alice computes the message amplitude a uu ' (lattice 
encoding) and then adds the mask qa/ achieving the signal 
amplitude a. Then, Alice prepares and sends to Bob the 
signal state [2), which is heterodyned by Bob with outcome 
P (step 1 in the picture). After detection, Bob classically 
informs Alice (step 2) and, then, Alice classically communi- 
cates the mask olm (step 3). Finally, Bob is able to unmask 
the signal (ft — an), thus reconstructing a uu i and, therefore, 
(U,U'). 

The above procedure of directly communicating mes- 
sage bits is called the message mode (MM) of the proto- 
col. However, Alice and Bob must also understand how 
much the channel is perturbed during the communica- 
tion process, in order to control the amount of informa- 
tion which is left to a potential eavesdropper. Assuming 
an attack with UGQCM, this corresponds to estimating 
the value of the noise a B := a 2 which is added by Eve to 
the channel. A real-time check of this noise is possible if 
Alice randomly switches from instances of message mode 
to suitable instances of control mode (CM). In control 
mode, Alice does not process any text message but only 
prepares and sends the signal state \a) (see Fig.@|. Then, 



after Bob's detection (outcome 0), Alice communicates 
the value a of the signal amplitude. At that point, Bob 
extracts from (/?, a) the actual value of the test variable 
t := f3 — a which is then used to infer the total noise 
A B = 1 + a 2 affecting the signal. As soon as they recog- 
nize a non-tolerable noise, i.e., a 2 > a 2 for some thresh- 
old noise <r 2 , they stop the communication. Hereafter, we 
assume a zero-tolerance protocol where no added noise is 
tolerated on the channel, i.e., a 2 — 0. We shall see that 
the QDC protocol can be applied in realistic situations 
even with such a strict condition 

Let us show how the real-time check of the quantum 
channel works in detail. Let us consider the Cartesian de- 
composition t = (q+ip)/y/2 of Bob's test variable. If the 
channel is noiseless, then the arbitrary quadrature x = q 
or p is only affected by heterodyne noise A = 1, i.e., it is 
distributed according to a Gaussian distribution Gi(x). 
By contrast, if Eve perturbs the quantum channel using 
a UGQCM with noise o 2 ^ 0, then x follows a wider 
Gaussian distribution Gi +a 2(x). By reconstructing the 
experimental distribution of x from consecutive outcomes 
{xi,X2, • • • }, Bob must therefore distinguish between the 
two theoretical distributions G\{x) and G 1+(T 2(x). In 
other words, Bob must distinguish between the two hy- 
potheses 



H 
-ffi 



(Eve = no) a 2 = , 
(Eve = yes) <^> a 2 ^ . 



(13) 



Let us fix the confidence level r of this hypothesis test, 
i.e., the probability to reject Hg though it is true. This 
level must be sufficiently low (e.g., r = 5 x 1CU 7 ), so 
that the direct communication can be effectively com- 
pleted in absence of Eve. For each instance of control 
mode, Bob makes two independent tests, one for each 
quadrature. Hence, after M control modes, he has col- 
lected 2M quadratures values {<Zi,pi, • • ■ ,qm, Pm} '■= 
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{xi, X2, • ' ' j %2M—i, %2m} and he can construct the es- 
timator 



2M 

1=1 



(14) 



Then, the hypothesis Hq is accepted if and only if 

V < V 2 M,l-r , (15) 

where Vjj is the jth quantile of the % 2 distribution with 
i degrees of freedom. In other words, Alice and Bob 
continue their direct communication in MM as long as 
the condition of Eq. (fT5|) is satisfied in CM. 

D. Gaussian eavesdropping 

Let us explicitly analyze what happens when the quan- 
tum communication channel is subject to Gaussian eaves- 
dropping via a UGQCM. In an individual UGQCM at- 
tack (see Fig. [5j, Eve clones the signal input and, then, 
heterodynes her output to derive her estimate 7 of the 
signal amplitude a. After the release of the mask's value 
O.M-, Eve infers the message amplitude a uu i and, there- 
fore, the input bits (U,U'). In this process, Eve intro- 
duces an added noise a 2 on the Alice-Bob channel (i.e., 
A B = 1 + er 2 ), while her output is affected by a total 



noise equal to Ae 

T 2 



1 + (4ct 2 ) -1 . This is the sum of the 
cloning noise a 2 E = (4cr 2 ) -1 , given by the UGQCM, and 
the measurement noise A = 1, given by the heterodyne 
detector. 
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FIG. 5: Individual UGQCM attack. Eve uses a UGQCM to 
eavesdrop the quantum communication line. Eve heterodynes 
her clone to get her estimate 7 of the signal amplitude a. 
After the public unmasking of the signal, Eve estimates a uu i 
and, therefore, the message bits (U,U ). 

First of all, we must evaluate the probability of accept- 
ing Hq (hence continuing the communication) notwith- 
standing the presence of Eve. In other words, we must 
compute the probability IIm(c 2 ) that Eve evades M con- 
trol modes while introducing a noise a 2 7^ 0. After M 



control modes, the estimator of Eq. ([14]) follows the dis- 
tribution 



Pm{v) 



„M-1 



2 M (M-l)!(l + o- 2 ) 



M 



exp 



2(1 + a 2 ) 



(16) 

As a consequence, the probability to accept Hq is equal 
to 

/■V2M,l-r 

n M (a 2 ) = / dv P M (v) 

Jo 

r(M, 0) - r (m, V2M ' 1 -' 



2(1+0 



(M — 1)! 



where 



r(z, a) := 



dt t z 



(17) 



(18) 



is the incomplete gamma function. 

Besides Eve's survival probability of Eq. (fl"7"|) , we must 
also evaluate the amount of information that Eve can 
get during her undetected life on the channel. Such a 
quantity is limited by the total noise experienced by Eve, 
which is equal to = 1 + (4cr 2 )~ 1 . For a given A^, 
we now calculate the average information Eve can steal 
in a single run of MM. Starting from the outcome of 
the measurement 7 and the knowledge of the mask ajf, 
Eve estimates Alice's amplitude a uu i via the variable 7 — 
am- The corresponding quadrature x will be distributed 
according to a Gaussian distribution Ga e (x — x u ). Then, 
by repeating the same derivation leading to Eq. (|10p . we 
can compute Eve's error probability in decoding Alice's 
bit (U or U'), which is equal to 



p(A £ ) 



00 rUj+3)Q 



dx Ga e ( x ) ■ 



(19) 



Let us assume that every message bit is a bit of infor- 
mation, i.e., the input message is not compressible. As 
a consequence, the average amount of information which 
is eavesdropped in a single MM is given by 



Iae(A e ) = 2{1 - H[p(A E )}} , (20) 



where 



H{j>) :=-plogp-(l-p)log(l-p) . (21) 

By replacing A E = 1 + (40- 2 )- 1 := A E (a 2 ) in Eq. QQ), 
we derive Iae — Iae(o- 2 )i i-e., the average amount of 
information which is stolen for a given noise a 2 in Alice- 
Bob channel. Such a quantity can be directly combined 
with IIm = IIm(o' 2 ) of Eq. (fT?) . This means that we 
can express Eve's survival probability as a function of 
the stolen information. In fact, let us fix the probabil- 
ity c of a control mode, so that N runs of the protocol 
can be divided into cN control modes and (1 — c)N mes- 
sage modes, on average. As a consequence, Eve's survival 
probability is equal to 



n cJV (a 2 ) := P 



(22) 
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and the average number of stolen bits is equal to 

{\-c)NI AE {a 2 ):=I . (23) 

Then, for every a 2 , we can consider the function P = 
P(P). In particular, let us fix c = 69/70, so that the 
protocol has efficiency 

£ number of bits 1 

number of transmitted systems 35 

For several values of a 2 , we can (numerically) evaluate 
the function P = P(I) as shown in Fig. [5J From this fig- 
ure, we can see that, if the noise is low, e.g., a 2 = 0.01, 
Eve steals very little information (~ 1 bit) while Alice 
and Bob complete an almost noiseless QDC. In partic- 
ular, Alice is able to transmit ~ 1.5 x 10 4 bits of infor- 
mation by using N ~ 5 x 10 5 systems. Notice that the 
maximum length of the QDC is roughly bounded by the 
verification of r" 1 hypothesis tests and, therefore, it is 
limited to about 4(1 -c)(cr) _1 bits (i.e., ~ 1.2 x 10 5 bits 
or ~ 4 x 10 6 systems using the above parameters). If 
the attack is more noisy (e.g., a 2 = 1), Eve again steals 
little information (~ 1 bit). In such a case, in fact, Eve 
is promptly detected by the honest parties who, how- 
ever, are prevented from exchanging information (denial 
of service). According to Fig.[6l Eve's best strategy cor- 
responds to using a UGQCM with a 2 ~ 1/20, so that 
she can steal a maximal amount of about 80 bits before 
being revealed (using a cut off of P = 1%). In such a 
case, Alice transmits ~ 630 bits by using N ~ 2.2 x 10 4 
systems. 



P 




10 20 30 40 50 60 70 
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FIG. 6: Survival probability P versus the number of stolen 
bits /. QDC with parameters Q — 2.57 and c = 69/70 (so 
that e = 1% and £ — 1/35). The curves refer to individual 
UGQCM attacks with different values of added noise a 2 . 

How can we decrease the maximal amount of stolen 
information? The simplest solution consists in increas- 
ing the control mode probability c, so that the possible 
presence of Eve is detected before sending too many bits. 
Clearly, this approach has a price to pay, which is a de- 
crease of the efficiency £ of the protocol. An alternative 
solution consists of making the decoding more sensitive 



to the presence of added noise. Such an approach is pos- 
sible by introducing classical error correcting codes, and 
its pros and cons are explored in the following section. 
In particular, this solution is good against Gaussian at- 
tacks but its advantages are not completely clear in the 
presence of non-Gaussian attacks. 

III. QUANTUM DIRECT COMMUNICATION 
WITH REPETITION CODES 

A. The basic idea in using classical codes 

In the basic scheme of QDC with continuous variables, 
a noiseless communication is possible up to an intrinsic 
error probability e which depends on the step fl of the 
phase-space lattice. In particular, such a probability de- 
creases for increasing fl. An alternative way for decreas- 
ing e consists of leaving Q unchanged while introducing 
a classical error correcting code for encoding/decoding. 
Such procedures are equivalent for a noiseless channel, 
since e is sufficiently small and the codes work very well 
in that case. However, the scenario is different as the 
channel becomes nosier. In such a case, in fact, the cor- 
recting codes have a non-linear behavior which makes 
their performance rapidly deteriorate. Such a non-linear 
effect can be exploited to critically split the correction ca- 
pabilities, and therefore the information gains, between 
Alice-Bob channel and Alice-Eve channel. 




0.1 0.2 0.3 0.4 0.5 



P 

FIG. 7: Probability of an uncorrectable error P n versus the 
single bit-flip probability p. Here, we consider repetition codes 
with n = 7, 15, 35, 103. 

Let us consider the simple case of an n-bit repetition 
code, where an input bit U = {0, 1} is encoded into a 
logical bit U = {0, 1} of n physical bits via the codewords 

= 0(F_0 , 1 = 11---1 . (25) 

n n 

By choosing an odd n — 2m + 1 (with m = 1, 2, ■ • • ), 
we can apply a non-ambiguous majority voting criterion. 
This means that every bit-flip error of weight t < m + 1 
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is correctable, while every bit-flip error of weight t > 
m + 1 is not. Let us now consider a memoryless channel, 
where each physical bit is perturbed independently with 
the same bit-flip probability p, as happens in the case of 
individual Gaussian attacks. Then, the probability of an 
uncorrectable error is simply given by 

Pn( P )= £ ( n k )p k (l- P ) n - k ■ (26) 
k=m+l ^ ' 

As it is evident from Fig. [7J the correction capability of 
the n-bit repetition code rapidly worsens as the single 
bit-flip probability approaches 1/2. This is due to the 
non-linear behavior of P n = P n (p) which becomes more 
manifest when n increases. In particular, for a sufficiently 
large n, the curve displays a critical point p after which 
the correction capability suddenly starts to deteriorate 
very quickly (e.g., p ~ 0.3 for n — 35 and p ~ 0.4 for 
n = 103). Exactly these critical points can be exploited 
to improve the QDC, by transforming the communication 
protocol into a threshold process, where the sensitivity to 
added noise is remarkably amplified. 

For a repetition code of fixed length n, we have a cor- 
responding critical value p. Then, we can choose a lattice 
whose step is critical. This is the value SI such that the 
intrinsic error probability is critical, i.e., e(Sl) — p. On 
the one hand, when the channel is noiseless, Bob is able 
to recover the codewords and reconstruct the logical bit 
with a very low error probability Pb = P n (p)- On the 
other hand, when the channel is noisy, Alice's informa- 
tion is split into two sub-channels: the Alice-Bob channel, 
with added noise a 2 B := er 2 , and the Alice-Eve channel, 
with added noise a% — (4<r ) . The corresponding error 
probabilities are respectively given by 

Pb = Pn(P + Pb) , Pe = Pn(P + Pe) , (27) 

where pb = Pb{&b) an< ^ Pe — Pe{o e ) are monotonic 
functions of the added noises (and, therefore, linked by 
the uncertainty principle) . Now, if Eve tries to hide her- 
self by perturbing the Alice-Bob channel with a relatively 
small pb, then her dual pe will always be big enough to 
perturb p into the nonlinear region. As a consequence, 
Eve will tend to experience Pe — 1/2 gaining her negli- 
gible information. 

Let us explain the previous point in terms of mutual 
information. In particular, let us fix the repetition code 
to the value n = 35, so that we have p ~ 0.3 and a cor- 
responding critical value SI ~ 1 for the lattice. Starting 
from an arbitrary SI, one can see that SI is indeed optimal 
for Alice and Bob. For every bit of information which is 
encoded by Alice, the amount of information decoded by 
Bob and Eve is respectively given by 

I AB = 1 - H(P B ) := I A B(n,a 2 ) , (28) 
I AE = 1 - H(P E ) := Iae{£1, a 2 ) , (29) 

where Pb and P E are the logical error probabilities in 
Eq. (|27p with n — 35. Since the added noises satisfy the 



uncertainty relation of Eq. (|T2|) , a similar relation holds 
for the mutual informations, i.e., 

I AB {n,a 2 ) + I AE {n,a 2 ) = ^a 2 ) , (30) 

where fi(il,a 2 ) < 2 is numerically shown in Fig. [51 Let 
us also consider the difference of information 

D(n,a 2 ) := \l AB {n,a 2 )-I AE (n,a 2 )\ . (31) 

Such a quantity is a point-by-point measure of how much 
I A b and I AE are different. In particular, the maximum 
value D = 1 corresponds to the maximal separation 
{I A b,Iae} = {0, 1} or {1,0}. As we can see from Fig. [HI 
the points (SI, cr 2 ) with £1 = 1 (i.e., with Q ~ ft) cor- 
responds to the broadest areas of separation. In other 
words, the critical condition f2 ~ SI enhances the split 
between I AE and I A e- 
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FIG. 8: Sum of the mutual informations Iab + Iae on the 
plane (Q,a 2 ). The values increase from (white area) to 2 
(black area). Note how the behavior of the borders changes 
around the critical value Cl ~ 1. 



B. Protocol with repetition codes 

Let us explicitly show how to use an n-bit repetition 
code for encoding/decoding. This is possible by simply 
adding pre-encoding and post-decoding classical steps to 
the basic protocol of Sec. [TTJ The message bits (U,U') 
are pre-encoded into a pair of logical bits 

U = U 1 U 2 ---U n , U 1 = U' 1 U' 2 ---U! n , (32) 

via the n-bit repetition code. Each pair of physical bits 
(C/fe, U' k ) is then subject to the same encoding as before, 
i.e., lattice encoding (Uk,U' k ) — > a u k u' k '■= a ki masking 
afc — > afe + qji = a and quantum preparation a — > \a). 
Then, after n message modes, Bob will have collected 
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FIG. 9: Difference D := \Iab — Iae\ on the plane (f2,cr 2 ). 
The values increase from D = (white area) to D — 1 (black 
area). Notice how the areas of separation (black areas) are 
broader at the critical value Cl ~ 1. 

perturbed versions of the n pairs (Ut, U[), ■ ■ ■ ,{U n ,U' n ). 
By applying standard error recovery (majority voting), 
he will then perform the post-decoding of (U,U'). In 
the same way as before, these instances of message mode 
(each one carrying a single physical bit of a codeword) 
must be randomly switched with instances of control 
mode, where Alice skips encoding and simply sends Gaus- 
sian signals a for testing the channel (exactly as in 
Fig. |U). 

Let us choose a repetition code with n = 35, and a 
lattice with Q = 1 ~ f2. The latter choice implies an in- 
trinsic error probability s, in decoding the physical bits 
(Uk, UL), which is equal to the critical value of the code 
p ~ 32%. After error recovery, the intrinsic error prob- 
ability e affecting the logical bits (U, U') is sufficiently 
low and corresponds to £35(35) — 1%. Then, let us also 
choose c = 1/2 for the control mode's probability, so that 
we have an efficiency £ — 1/35. Notice that the values 
of e and £ correspond to the ones chosen for the basic 
protocol of Sec. |TT] (where e = e of course). Such parame- 
ters equalize the performances of the two protocols in the 
case of noiseless quantum channel. As a consequence, we 
are in a situation to make a fair comparison between the 
protocols when malicious noise is present on the channel. 



C. Gaussian eavesdropping 

Let us analyze the effect of an individual UGQCM 
attack. On every cloned system, affected by a noise 
a\ = (4cr 2 ) -1 , Eve detects the complex amplitude 7 
via heterodyne detection. Then, she estimates the sig- 
nal amplitude a up to a total noise A E = 1 + a\. Af- 
ter Alice's declaration of the mask olm, Eve derives the 
message amplitude and, therefore, a pair of physical bits 
(Uk, UL). Each physical bit will be affected by an error 



probability p(A E ) as in Eq. (p~9|) . After n eavesdropped 
message modes, Eve will be able to decode Alice's logical 
bits (U , U') by majority voting, up to an error probabil- 
ity P E = P n [p(A E )} [see Eq. J2BJ]. For each logical bit, 
the acquired information is simply equal to 1 — H(P E ). 
As a consequence, for each message mode, Eve acquires 
on average 

I AE {a 2 ) = 2[l-H{P E )]/n (33) 

bits of information (simply because 2 logical bits are sent 
via n physical systems). 

Now, let us consider the probability that Eve evades 
M control modes. Since the control mode is implemented 
exactly as before, we have again I1m((t 2 ) as in Eq. (flTf . 
Such a quantity can be combined with the one of Eq. (|33[) . 
After N runs of the protocol, we have an average of cN 
control modes and (l — c)N message modes, so that Eve's 
survival probability is again H c n(<j 2 ) := P and the stolen 
information equal to (1 — c)NIae(o' 2 ) := I. Then, for 
every a 2 , we can again evaluate the curve P = P(I), 
expressing Eve's survival probability as a function of the 
stolen bits. According to Fig. [101 the best choice for 
Eve is a UGQCM with a 2 ~ 0.3, which enables her to 
steal about 10 bits of information before being detected. 
Such a result is a strong improvement with respect to 
the basic protocol, where 80 bits were left to Eve. Notice 
that, for a low value of the noise like a 2 = 0.1, Eve gets 
~ 1 bit while Alice transmits ~ 320 bits of information 
by using TV ~ 1.1 x 10 4 systems. The maximal length 
of QDC is here bounded by 4(1 - ^(ncr)" 1 ~ 3500 bits, 
i.e., N ~ 1.2 x 10 5 quantum systems. 
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FIG. 10: Survival probability P versus the number of stolen 
bits I. QDC with repetition code n = 35, and parameters Q = 
1 ~ fi, c = 1/2 (so that e ~ 1% and £ = 1/35). The curves 
refer to individual UGQCM attacks with different values of 
added noise a 2 . 

It is important to notice that the strong improvement 
brought by the classical codes is proven provided the 
eavesdropping strategy is fixed, i.e., Eve is restricted to 
an individual Gaussian attack where all the signal sys- 
tems are attacked by a UGQCM. The idea of using repe- 
tition codes is in fact based on the condition that all the 
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systems are perturbed exactly in the same way. However, 
this is not true in general, and we can design more appro- 
priate strategies for Eve, which are specifically optimized 
against the use of classical codes. This is the argument 
of the following section. 

D. Non-Gaussian eavesdropping via intermittent 
attacks 

In the previous Section UlI C| the QDC with repetition 
codes has been tested against the same kind of attack 
considered for the basic QDC. This attack is an individ- 
ual UGQCM attack, which is indeed a Gaussian attack 
if it is applied to every quantum system which is sent 
through the channel. Notice that the same Gaussian in- 
teraction provided by the UGQCM generates an overall 
non-Gaussian attack if it is applied to only a fraction of 
the signal systems. This because an intermittent use of 
Gaussian interactions corresponds to the generation of 
an average non-Gaussian interaction. 

In this section, we introduce the notion of intermittent 
attacks which are individual non-Gaussian attacks based 
on the intermittent use of a UGQCM. They are char- 
acterized by two parameters: the frequency parameter 
uj and the noise parameter a 2 . The frequency parame- 
ter uj defines the probability that Eve attacks a signal 
system via a UGQCM (and, then, detects the output 
clone via heterodyning). The noise parameter a 2 defines 
the cloning noise variance which is introduced by the 
UGQCM on the signals which are effectively attacked. 
Then, for N transmitted systems, a fraction Nuj is sub- 
ject to cloning interactions with noise <r 2 , while another 
fraction N(l — uj) is not perturbed by Eve. On average, 
Bob's output quadrature x — q,p will follow the non- 
Gaussian distribution 

F^ (a;) = LoG 1+rT 2 (a;) + (1 - uj)G x (x) , (34) 

where Ga(x — x) is defined in Eq. ©. Clearly, in the 
particular case of uj = 1, this attack becomes Gaussian 
and coincides with an individual UGQCM attack. 

An intermittent attack can allow Eve to probe a subset 
of the systems very heavily, instead of probing all the sys- 
tems with a weaker interaction. This peculiarity plays a 
non-trivial role in the case of QDC with repetition codes, 
where the eavesdropping of a single bit of a codeword can 
be sufficient to reconstruct all the encoded logical infor- 
mation. Here, we explicitly show the superiority of the 
intermittent attacks against the use of repetition codes. 
For the sake of simplicity, we consider only those attacks 
whose frequencies can be written as uj = t/n, where n is 
the length of the code and t is an odd integer between 1 
and n. 

After N runs of the protocol, an intermittent attack 
of frequency uj (and noise a 2 ) will affect an average of 
Nuj systems, where cNuj are in CM and (1 — c)Nuj are in 
MM. Let us consider the MM first. For each codeword 
of length n, there is an average of t — nuj bits attacked 



by Eve. Over these bits, Eve adopts the criterion of ma- 
jority voting in order to reconstruct the codeword. As a 
consequence, the probability of a logical error is equal to 
the probability of having at least (t + l)/2 bit flips, i.e., 

P ^)= E (l)^ 1 -?)". ( 35 ) 

u—i+l ^ ' 
ft,— — — 

where p — p(Ae) is the single bit-flip probability in the 
Alice- Eve channel, which is determined by As = 1 + 
(4er 2 ) -1 . Then, for each MM, Eve extracts on average 

I AE (a 2 ,uj)=2{l-H[P E (t)]}/n (36) 

bits of information. After N runs of the protocol, we have 
an average of (1 — c)N instances of MM and, therefore, 
Eve has stolen I = (1 — c)NIa E {ct 2 , uj) bits of informa- 
tion. Now, let us consider the CM. For each instance 
of CM, Bob performs two hypothesis tests, so that an 
average of 2cN tests are done after N runs of the pro- 
tocol. Bob must distinguish between the two hypotheses 
of Eq. ([12]), which here means to distinguish between the 
two distributions F w fi(x) — G\(x) (which is Gaussian) 
and Fu, a z{x) with a 2 ^ (which is non-Gaussian). Sup- 
pose that Bob knows exactly which are the instances of 
CM that are attacked by Eve. This assumption clearly 
puts a lower bound on the eavesdropping capabilities of 
Eve, which is however sufficient to prove the result. In 
this case, Bob is able to isolate the cNuo attacked in- 
stances of CM from the cN(1—uj) instances which are not 
attacked. On the attacked subset, Bob can now perform 
2cNuj tests in order to distinguish between two Gaus- 
sian distributions, i.e., G 1+cr 2(x) and Gi{x). Then, we 
have to consider the estimator of Eq. (TT4"]) . but now with 
A I = cNuj. As a consequence, the survival probabil- 
ity of Eve after N runs of the protocol is now given by 

P = HcNu{(T 2 ). 

For every intermittent attack specified by the pair 
{w,<7 2 }, we can now relate the survival probability P 
to the number of stolen bits /, i.e., we can consider the 
function P = P(I). By adopting the previous parameters 
for the QDC protocol, i.e., n = 35, = 1 and c = 1/2, 
we derive the curves of Fig. [Tl] for different values of the 
pair {uj,a 2 }. In particular, we have chosen the frequen- 
cies uj in the set {1, 1/7, 3/35, 1/35} and taken the corre- 
sponding optimal noises a 2 which maximize Eve's stolen 
information. As expected, the value of the optimal noise 
increases for decreasing frequency. In particular, the best 
performance is achieved for uj — 1/35 (lowest frequency) 
and a 2 = 0.4 (highest noise), where Eve is able to eaves- 
drop 20 bits. Notice that this value is actually a lower 
bound on Eve's capabilities, i.e., Eve is able to steal at 
least 20 bits. In fact, except for the case uj = 1 (Gaussian 
attack), all the curves are actually lower bounds on the 
actual performances of Eve. Nevertheless, this is suffi- 
cient to prove the superiority of the intermittent attacks 
in the eavesdropping of QDC with repetition codes. No- 
tice that the actual performances of these non-Gaussian 
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attacks could be much better. It is not excluded that 
they could completely annul the advantages brought by 
the use of the classical codes. 
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FIG. 11: Survival probability P versus the number of stolen 
bits I. QDC with repetition code n = 35, and parameters 
A = 1 ~ A, c = 1/2 (so that e ~ 1% and £ = 1/35). The 
curves refer to intermittent attacks with different parameters 
(lu,(t 2 ). In particular, we have chosen lu — 1, 1/7,3/35, 1/35 
and the corresponding optimal noises a 2 — 0.3, 0.35, 0.39, 0.4 . 



IV. CONCLUSION 

In thispaper we have thoroughly reviewed the results 
of Ref. p, and we have also provided a deeper analy- 
sis of possible eavesdropping strategies. In particular, 
the usage of classical correcting codes for QDC leads to 
the birth of new kind of attacks, the intermittent at- 
tacks, which are non-Gaussian and outperform the stan- 
dard Gaussian attacks considered in Ref. @. Because 
of this new strategy, the real advantages of using clas- 
sical codes for QDC are not completely clear. Despite 
this open problem, the adoption of a basic QDC, with 
a suitable control mode probability, always enables the 
honest users to decrease the number of stolen bits to any 
desired value. Clearly, this is done at the expenses of 
the efficiency of the protocol. This trade-off between the 
degree of privacy and efficiency of the protocol is quite 
intuitive in our derivation. In future work, it would be 
interesting to investigate the existence of a precise re- 
lation between these two quantities. However, in order 
to derive this kind of relation, the cryptoanalysis of the 
QDC should be first extended to more general eavesdrop- 
ping models, e.g., collective Gaussian attacks involving 
the use of beam-splitters with thermal inputs, or more 
general Gaussian interactions [Hj]. At the present stage, 
our protocols represent a simple proof-of-principle of a 
confidential QDC in the framework of continuous vari- 
able systems, whose performances are not definitive at all 
and could be greatly improved in future investigations. 



As already discussed in Ref. @, our protocols for 
QDC allow an effective communication only when a small 
amount of noise affects the quantum channel, thus re- 
stricting their current application to relatively short dis- 
tances. Despite this restriction, there are however non- 
trivial situations where they can be used in a profitable 
way. As explained in Ref. [6J, one of the possible appli- 
cations is mutual entity authentication |l6[, where the 
two users identify each other by comparing the bits of 
a pre-distributed and secret authentication key. In this 
case, the usage of QDC is particularly profitable in the 
presence of quantum impersonation attacks (T7| . which 
are promptly revealed by relatively small sessions of our 
basic protocol. 
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VI. APPENDIX: POSSIBLE VARIANTS FOR 
QDC 

Here we briefly present several possible variants of the 
previous protocols. 

A. QDC using homodyne detector 

Simple variants of the previous protocols for QDC can 
be implemented via homodyne instead of heterodyne de- 
tection. It is sufficient that Alice encodes one single bit 
in the lattice by setting U = U' . Then, Bob randomly 
switches between q and p measurements, the exact se- 
quence being communicated to Alice at the end of the 
quantum communication. In such a case, Eve is forced 
to a delayed-choice strategy, where she has to keep all 
her ancillas before making the correct homodyne mea- 
surement on each of them. Similar results can be easily 
proven for these variants by considering that now the 
measurement noise is A = 1/2. 

B. Unifying control and message modes 

Whenever the QDC is based on heterodyne detection 
and implemented with a control mode probability c = 
1/2 (as in the case of the protocol of Sec. IIII B"j) . one can 
decide to distribute the control and message modes on 
all the quantum systems. This is possible by randomly 
choosing a quadrature for the encoding and the other for 
the check. Then, after Bob's heterodyne detection, Alice 
declares the quadrature to be used for public comparison. 
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C. Postponed QDC 

In the basic protocol of Sec. [Til run-by-run and after 
Bob's detection, Alice declares which mode she has used 
(MM or CM) and the corresponding classical informa- 
tion (mask amplitude olm or signal amplitude a). An 
alternative protocol consists in delaying this declaration 
until the end of the quantum communication. At that 
point, Alice will only declare the instances in CM and 
the corresponding amplitudes. Such a procedure enables 
Alice and Bob to evaluate the noise of the channel be- 
fore revealing any confidential information. From such 



an estimation, Alice computes the amount of informa- 
tion Iae that Eve can steal if she unmasks the message. 
If Iae is negligible (according to a pre-agreed tolerance 
level), then Alice unmasks all the message modes, com- 
municating her message to Bob. Otherwise, she has to 
abort. Alternatively, when Iae is not negligible but less 
than Iab , Alice and Bob can possibly use the remaining 
systems for distributing a secret key. Notice that such 
a postponed protocol takes no advantage from the use 
of codes. Furthermore, it can be simply implemented 
with c = 1/2 and, therefore, also modified according to 
Sec. Em 
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